Trezor One firmware left seed in RAM, readable with physical access

In August 2017 SatoshiLabs released Trezor One firmware 1.5.2 to fix a vulnerability reported through its responsible disclosure programme. According to EtherWorld’s summary of the disclosure timeline, the flaw was reported on 1 August 2017 and affected all devices with firmware older than 1.5.2; the fixed firmware was released on 16 August. Saleem Rashid published an independent write-up of the issue on 17 August.

Rashid describes the attack as requiring physical access to an opened device: resetting the microcontroller without cutting power leaves the RAM contents intact, because the old bootloader did not clear all of RAM at startup, and custom firmware flashed afterwards can read the wallet’s secrets from a known memory address. He notes that a BIP39 passphrase is not stored on the device, so a passphrase-protected wallet is not exposed. Firmware 1.5.2 moves secret data into a part of RAM the bootloader overwrites, and Rashid states that 1.5.2 is not vulnerable to this exploit or any variation of it.

SatoshiLabs published its own report on 18 August 2017, earlier than planned, it says, because of misinformation about the update. It confirms the timeline (reported 1 August, firmware 1.5.2 released 16 August), describes the attack as requiring physical access to a disassembled device, and states that an anonymous article claiming Trezor had been hacked described an attack vector that 1.5.2 had already closed. Trezor adds that new devices received a bootloader that clears all RAM, that downgrading below 1.5.2 wipes the storage, and that all devices based on Trezor’s design were potentially vulnerable, so it informed other hardware wallet makers. In January 2022 Joe Grand used a voltage-glitching attack to recover the forgotten PIN of a Trezor One running older firmware, on which, Decrypt and Cointelegraph report, the PIN and key were present in RAM. Trezor responded that this was an outdated exploit, not a concern for current users, fixed in 2017 after a responsible disclosure report, and that it requires full physical access to the device.